Wireshark · Ethereal-dev: Re: [Ethereal-dev] Follow TCP Stream decoder plugins?

[Olaf van der Spek <olafvdspek@xxxxxxxxx>]

On 5/9/05, Ulf Lamping <ulf.lamping@xxxxxx> wrote:
> Olaf van der Spek wrote:
> 
> >But only for that single packet, right?
> >
> No, the defragmentation for instance will show the content of the
> unfragmented PDU content (which might be spreaded over several packets).
> But of course not the whole TCP stream.

But that's what's needed, a view of the entire stream.
 
> >>Yes, I know what you mean. There are a lot of protocols that would
> >>benefit from a general way of handling such stream conversations.
> >>
> >>That seems to become a common problem, where we might need a generalized
> >>approach to show such stream content. The follow TCP stream window is
> >>only a limited, of what a content window could show up...
> >>
> >>Recently, some effort had been done to build graphs for general data
> >>flow, we might need something similar for the various protocols content.
> >>
> >>
> >
> >Would it be possible for the short-term to add a Save Raw Raw option
> >to safe a raw TCP stream to a binary file?
> >It'd include not just the data, but also timing information.
> >
> >
> There's already an option to save the bytes in raw binary format in that
> dialog.

But how can one tell the source of the bytes (from A or from B)?

> I don't know how you would add timing information, without defining a
> new file format. That would be a thing carefully thought about.